@xgamesfun/xcore 0.2.0 → 0.3.0

package/lib/client/gamesfun.js

@@ -6,15 +6,18 @@
 //
 //   const gf = GamesFun;
 //   await gf.ready;                                   // what the page already knows (a sign-in the xgames.fun page has)
-//   gf.player;                                        // null, or {id, name, level, wallet, x}
+//   gf.player;                                        // null, or {id, name, level, wallet, x, google}
 //   gf.local;                                         // true on this machine (localhost, xcore check, xcore dev)
 //   gf.dev;                                           // true under xcore dev, where the game's server, saves and
 //                                                     // sign-in answer as xgames.fun's will: "no server here" is
 //                                                     // gf.local && !gf.dev, never gf.local alone
 //   await gf.signIn();                                // from a click: the player signs in → player | null
+//   await gf.signIn({how: 'google'});                 // the same with Google ('x', the default: with X)
 //   gf.onChange(player => …);                         // sign-in and sign-out
 //   gf.onCode(({code, site, url, window}) => …);      // the code: show it plainly when window is false (blocked);
 //                                                     // when true, only as a quiet line: X's login hides the window's state
+//   await gf.fullscreen();                            // from a click: full screen (again: back); → {on, how}
+//   gf.onFullscreen(on => …);                         // it went in or out (Esc, the page, the browser)
 //   await gf.saves.put('main', {level: 3});           // this player's saves: JSON, 64 KB each, 16 a player
 //   await gf.scores.submit('best', 1200);             // leaderboards: a player's best is kept
 //   await gf.db.add('levels', {name: 'Moon'});        // the game's own database (xcore add database): each player
@@ -22,8 +25,13 @@
 //   await gf.api('scores', {method: 'POST', body: {}}); // the game's own server (server/), signed in
 //   const {data: room} = await gf.rooms.join(gf.rooms.fromLink() ?? gf.rooms.code()); // multiplayer (xcore add multiplayer)
 //   room.on('message', (from, data) => …); room.send({x: 1}); share gf.rooms.link(room.code)
+//   const {data: live} = await gf.live.get();         // what the owner set on xgames.fun/console (Live), no republish:
+//                                                     // {announcement, config, version, maintenance}; a banner shows
+//                                                     // the announcement (gf.live.banner(false) turns it off)
+//   gf.live.onChange(live => …);                      // asked again every minute while the page is in view
 //
-// Where sign-in comes from (xgames.fun's player sign-in: X first, a wallet as well):
+// Where sign-in comes from (xgames.fun's player sign-in: X or Google; a wallet is linked to that account on xgames.fun's
+// account page and comes with every sign-in, but never signs anyone in: a copycat game could relay that signature):
 // - inside xgames.fun's play page, the page above signs the player in and hands this page a token (gf:host / gf:auth);
 //   only xgames.fun's own page may: framed by any other site (one embedding the game), the game signs in by itself;
 // - on the game's own link or inside a post on X, a small window on xgames.fun signs in (or a code the player types at
@@ -37,7 +45,7 @@
 (function () {
   'use strict';
   if (globalThis.GamesFun) return;
-  var VERSION = '1.4.0';
+  var VERSION = '1.6.0';
   var PLATFORM = '/platform/v1/';
   var SEG = /^[A-Za-z0-9_-]{1,64}$/;
   var POLL_MS = 2000;
@@ -147,6 +155,9 @@
             var why = (data && (data.why || data.error)) || label + ' answered ' + res.status;
             var no = { data: null, error: why, status: res.status };
             if (data && data.code) no.code = data.code;
+            // the game was paused (Live, maintenance) while it was open: the banner says so at once (xgames.fun's
+            // refusal is a 503; a game's own server that says 'maintenance' with another status is its own business)
+            if (res.status === 503 && data && data.code === 'maintenance') liveMaintenance(data);
             return no;
           });
       })
@@ -269,7 +280,16 @@
       if (gf.token && a.status !== 'signing') setPlayer(null, '', 0);
     } else if (token !== gf.token) {
       var x = a.x && a.x.handle ? a.x : null;
-      var guess = { id: '', name: x ? '@' + x.handle : a.short || '', level: a.level, wallet: a.wallet || '', x: x };
+      // the name players see: @handle for X; a Google account's player name (never with an @, which only X has)
+      var g = a.google && a.google.name ? { name: String(a.google.name) } : null;
+      var guess = {
+        id: '',
+        name: x ? '@' + x.handle : g ? g.name : a.short || '',
+        level: a.level,
+        wallet: a.wallet || '',
+        x: x,
+        google: g,
+      };
       done = takeToken(token, guess, a.expires || Date.now() + 3600e3);
     }
     return done.then(function () {
@@ -326,6 +346,8 @@
           above = e.source;
           aboveAuth = e.data.auth !== false;
           readyResolve(gf.player);
+        } else if (e.data.type === 'gf:fullscreen-state') {
+          setFull(e.data.on === true);
         } else if (e.data.type === 'gf:auth') {
           above = e.source;
           takeAuth(e.data).then(function () {
@@ -396,12 +418,14 @@
           closePopup(p);
           var pl = s.player || {};
           var x = pl.x && pl.x.handle ? pl.x : null;
+          var g = pl.google && pl.google.name ? { name: String(pl.google.name) } : null;
           var guess = {
             id: '',
-            name: x ? '@' + x.handle : pl.wallet || '',
+            name: x ? '@' + x.handle : g ? g.name : pl.wallet || '',
             level: pl.level,
             wallet: pl.wallet || '',
             x: x,
+            google: g,
           };
           // still this sign-in's until the token is taken: a click meanwhile waits for the same player
           takeToken(s.token, guess, s.expires).then(function (player) {
@@ -456,11 +480,12 @@
 
   /**
    * The player's sign-in. From a click (a window may open). → player | null. `prompt: false` opens nothing and only
-   * takes a sign-in the page already has. `how`: 'x' (default) or 'wallet'.
+   * takes a sign-in the page already has. `how`: 'x' (default) or 'google' ('wallet', from before, signs in with X: a
+   * wallet signs nobody in now; the player links one on xgames.fun's account page).
    */
   gf.signIn = function (opts) {
     opts = opts || {};
-    var how = opts.how === 'wallet' ? 'wallet' : 'x';
+    var how = opts.how === 'google' ? 'google' : 'x';
     // a sign-in on its way (to its last step, the player's token being taken): this click waits for the same one
     if (pending && opts.prompt !== false) return pending.promise;
     if (gf.token && gf.expires > Date.now() + 60e3) return Promise.resolve(gf.player);
@@ -487,7 +512,7 @@
           } else waiters.push(wait); // an answer without a token yet (the page is still signing)
         };
         waiters.push(wait);
-        above.postMessage(how === 'x' ? { type: 'gf:auth-signin', with: 'x' } : { type: 'gf:auth-signin' }, '*');
+        above.postMessage({ type: 'gf:auth-signin', with: how }, '*');
       });
     }
     return requestSignIn(how);
@@ -502,6 +527,317 @@
     return Promise.resolve(null);
   };
 
+  // ---- live: what the game's owner sets on xgames.fun/console (the Live tab), with no republish ----
+  // GET /platform/v1/live, answered by the play edge itself from one cached record a game: {announcement: {id, text,
+  // level: 'info'|'warning', startsAt, endsAt} | null, config: {…}, version, maintenance: {message, since} | null}. The
+  // config is the owner's JSON object (8 KB); while maintenance is on, players who open the game get xgames.fun's
+  // holding page instead, and the game's api/ and saves and scores answer code 'maintenance'. A change reaches players
+  // within about 35 seconds. On this machine (localhost, xcore check) nothing is live; `xcore dev` answers from the
+  // game's .gamesfun/live.json; where there is no such route (an older host) nothing is live and nothing is asked again.
+  //   A small banner shows the announcement (each one until the player closes it), and a pause that starts while the
+  //   game is open. Off: globalThis.GAMESFUN_LIVE_BANNER = false before this file, data-live-banner="off" on its
+  //   <script>, or gf.live.banner(false) before the page has loaded.
+  var LIVE_EMPTY = { announcement: null, config: {}, version: 0, maintenance: null };
+  var LIVE_POLL_MS = 60000; // asked again this often while gf.live.onChange has a listener (and the page is in view)
+  var LIVE_BANNER_MS = 300000; // and this often for the banner alone
+  var liveValue = null,
+    liveAt = 0,
+    liveFlight = null,
+    liveFns = [],
+    liveGone = false,
+    liveTimer = null,
+    banner = null,
+    bannerKey = '',
+    bannerEnd = null;
+  var me = globalThis.document && document.currentScript;
+  var bannerOn =
+    globalThis.GAMESFUN_LIVE_BANNER !== false &&
+    !(me && me.getAttribute && me.getAttribute('data-live-banner') === 'off');
+  var num = function (v) {
+    return typeof v === 'number' && isFinite(v) && v > 0 ? v : null;
+  };
+  /** An answer → what a game gets: an announcement only inside its window (by this clock too), a plain-object config. */
+  function liveClean(d) {
+    if (!d || typeof d !== 'object') return LIVE_EMPTY;
+    var now = Date.now();
+    var a = d.announcement;
+    a =
+      a && typeof a === 'object' && typeof a.text === 'string' && a.text
+        ? {
+            id: String(a.id || 'a'),
+            text: a.text,
+            level: a.level === 'warning' ? 'warning' : 'info',
+            startsAt: num(a.startsAt),
+            endsAt: num(a.endsAt),
+          }
+        : null;
+    if (a && ((a.startsAt && a.startsAt > now) || (a.endsAt && a.endsAt <= now))) a = null;
+    var m = d.maintenance;
+    return {
+      announcement: a,
+      config: d.config && typeof d.config === 'object' && !Array.isArray(d.config) ? d.config : {},
+      version: num(d.version) || 0,
+      maintenance: m && typeof m === 'object' ? { message: String(m.message || ''), since: num(m.since) } : null,
+    };
+  }
+  function setLive(v) {
+    var before = liveValue ? JSON.stringify(liveValue) : '';
+    liveValue = v;
+    gf.live.value = v;
+    if (JSON.stringify(v) !== before) {
+      emit(liveFns, v);
+      renderBanner();
+    }
+  }
+  function liveRefresh() {
+    if (local) {
+      setLive(LIVE_EMPTY);
+      return ok(LIVE_EMPTY);
+    }
+    if (liveFlight) return liveFlight;
+    liveFlight = call(PLATFORM + 'live', { method: 'GET' }, "the game's live settings").then(function (r) {
+      liveFlight = null;
+      liveAt = Date.now();
+      if (r.data) {
+        setLive(liveClean(r.data));
+        return { data: liveValue, error: null, status: r.status };
+      }
+      // no such route here (an older host): nothing is live, and nothing is asked again
+      if (r.status === 404) {
+        liveGone = true;
+        setLive(LIVE_EMPTY);
+        return { data: liveValue, error: null, status: 404 };
+      }
+      // not reachable now: what was known stays
+      return withCode({ data: liveValue || LIVE_EMPTY, error: r.error, status: r.status }, r);
+    });
+    return liveFlight;
+  }
+  function liveMaintenance(d) {
+    var v = liveValue || LIVE_EMPTY;
+    if (v.maintenance) return;
+    setLive({
+      announcement: v.announcement,
+      config: v.config,
+      version: v.version,
+      maintenance: { message: String(d.why || ''), since: num(d.since) },
+    });
+  }
+  function livePoll() {
+    if (liveTimer || liveGone || local || typeof setInterval !== 'function') return;
+    liveTimer = setInterval(function () {
+      if (liveGone) {
+        clearInterval(liveTimer);
+        liveTimer = null;
+        return;
+      }
+      if (globalThis.document && document.visibilityState === 'hidden') return;
+      var every = liveFns.length ? LIVE_POLL_MS : bannerOn ? LIVE_BANNER_MS : 0;
+      if (every && Date.now() - liveAt >= every) liveRefresh();
+    }, 15000);
+  }
+  // the banner: one line at the top, above the game, closable; text only (never HTML)
+  function renderBanner() {
+    var doc = globalThis.document;
+    if (!doc || typeof doc.createElement !== 'function') return;
+    if (!doc.body) {
+      doc.addEventListener('DOMContentLoaded', renderBanner, { once: true });
+      return;
+    }
+    var v = liveValue,
+      show = null;
+    if (bannerOn && v && v.maintenance)
+      show = {
+        key: 'm' + (v.maintenance.since || ''),
+        text: v.maintenance.message || 'This game is paused for maintenance.',
+        level: 'warning',
+      };
+    else if (bannerOn && v && v.announcement)
+      show = { key: v.announcement.id, text: v.announcement.text, level: v.announcement.level };
+    if (show && store('live-closed') === show.key) show = null;
+    clearTimeout(bannerEnd);
+    if (!show) {
+      if (banner && banner.parentNode) banner.parentNode.removeChild(banner);
+      banner = null;
+      return;
+    }
+    // an announcement that ends while the game is open goes when it ends
+    var ends = !v.maintenance && v.announcement.endsAt;
+    if (ends)
+      bannerEnd = setTimeout(
+        function () {
+          setLive(liveClean(liveValue));
+        },
+        Math.min(Math.max(ends - Date.now(), 0), 2147483647),
+      );
+    if (!banner) {
+      banner = doc.createElement('div');
+      banner.setAttribute('data-gamesfun', 'live');
+      var root = banner.attachShadow ? banner.attachShadow({ mode: 'open' }) : banner;
+      root.innerHTML =
+        '<div role="status" aria-live="polite" style="position:fixed;top:8px;left:50%;transform:translateX(-50%);z-index:2147483647;' +
+        'box-sizing:border-box;max-width:min(640px,calc(100vw - 16px));display:flex;align-items:flex-start;gap:10px;padding:8px 10px 8px 14px;' +
+        'border-radius:10px;font:14px/1.4 system-ui,-apple-system,sans-serif;box-shadow:0 4px 18px rgba(0,0,0,.35);pointer-events:auto">' +
+        '<span style="white-space:pre-wrap;overflow-wrap:anywhere"></span>' +
+        '<button type="button" aria-label="Close" style="all:unset;cursor:pointer;padding:0 4px;font-size:18px;line-height:1;opacity:.75">×</button></div>';
+      root.querySelector('button').addEventListener('click', function () {
+        store('live-closed', bannerKey);
+        renderBanner();
+      });
+      doc.body.appendChild(banner);
+    }
+    var root2 = banner.shadowRoot || banner;
+    var box = root2.querySelector('[role=status]');
+    box.style.background = show.level === 'warning' ? '#4a3510' : '#1d1d26';
+    box.style.color = show.level === 'warning' ? '#ffe6b0' : '#e8e8f0';
+    box.style.border = '1px solid ' + (show.level === 'warning' ? '#a8761c' : '#3a3a4a');
+    root2.querySelector('span').textContent = show.text;
+    bannerKey = show.key;
+  }
+  gf.live = {
+    /** The last answer (null until one came). */
+    value: null,
+    /** → {data: {announcement, config, version, maintenance}}: what is known if it is under a minute old, else asked. */
+    get: function () {
+      if (liveValue && (liveGone || local || Date.now() - liveAt < LIVE_POLL_MS) && !liveFlight) return ok(liveValue);
+      return liveRefresh();
+    },
+    /** Asks now. → as get */
+    refresh: liveRefresh,
+    /** fn(live) on every change; while any listener is there it is asked every minute (the page in view). → unsubscribe */
+    onChange: function (fn) {
+      if (typeof fn === 'function') liveFns.push(fn);
+      livePoll();
+      if (!liveAt && !liveFlight) liveRefresh();
+      return function () {
+        liveFns = liveFns.filter(function (f) {
+          return f !== fn;
+        });
+      };
+    },
+    /** The default banner on (true) or off (false): a game that shows the announcement its own way turns it off. */
+    banner: function (on) {
+      bannerOn = on !== false;
+      renderBanner();
+      if (bannerOn && !local) {
+        livePoll();
+        if (!liveAt && !liveFlight) liveRefresh();
+      }
+    },
+  };
+  // the banner's first look once the page has loaded (so a game's own scripts can turn it off first), then every 5 min
+  if (!local && globalThis.document && typeof document.addEventListener === 'function') {
+    var liveStart = function () {
+      setTimeout(function () {
+        if (bannerOn && !liveAt && !liveFlight) liveRefresh();
+        if (bannerOn) livePoll();
+      }, 0);
+    };
+    if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', liveStart, { once: true });
+    else liveStart();
+    document.addEventListener('visibilitychange', function () {
+      if (document.visibilityState !== 'visible' || liveGone || !(liveFns.length || bannerOn)) return;
+      if (liveAt && Date.now() - liveAt >= LIVE_POLL_MS) liveRefresh();
+    });
+  }
+
+  // ---- full screen, from a click: a post on X and a phone show the game in a small frame first ----
+  // Inside xgames.fun's play page the page around the game goes full screen (gf:fullscreen), or fills the screen where the
+  // browser has no full screen (an app's own browser: X's, Phantom's); a click in the game lets that page ask. Anywhere
+  // else the browser's own full screen; framed where that is not allowed (another site's frame, a post on X), the game's
+  // own link in a tab of its own. An iPhone's Safari has no full screen for a page: {on: false, how: 'none'}, the game
+  // plays as it is (its button can say "Add to Home Screen" there).
+  var fullFns = [];
+  gf.isFullscreen = false;
+  function setFull(on) {
+    if (gf.isFullscreen === on) return;
+    gf.isFullscreen = on;
+    emit(fullFns, on);
+  }
+  gf.onFullscreen = function (fn) {
+    if (typeof fn === 'function') fullFns.push(fn);
+    return function () {
+      fullFns = fullFns.filter(function (f) {
+        return f !== fn;
+      });
+    };
+  };
+  var doc = globalThis.document;
+  function nativeFull() {
+    return !!doc && !!(doc.fullscreenElement || doc.webkitFullscreenElement);
+  }
+  if (doc && doc.addEventListener)
+    ['fullscreenchange', 'webkitfullscreenchange'].forEach(function (ev) {
+      doc.addEventListener(ev, function () {
+        setFull(nativeFull());
+      });
+    });
+  /** on: true (in), false (out), or left out (the other way). → {data: {on, how: 'page'|'browser'|'tab'|'none'}} */
+  gf.fullscreen = function (on) {
+    var want = on === undefined ? !gf.isFullscreen : !!on;
+    if (above) {
+      // the play page answers gf:fullscreen-state; it tells only a change, so a refusal there leaves it as it was
+      try {
+        above.postMessage({ type: 'gf:fullscreen', v: 1, on: want }, '*');
+      } catch {
+        /* gone */
+      }
+      return new Promise(function (resolve) {
+        var off,
+          timer = setTimeout(function () {
+            off();
+            resolve(ok({ on: gf.isFullscreen, how: 'page' }));
+          }, 1500);
+        off = gf.onFullscreen(function (now) {
+          clearTimeout(timer);
+          off();
+          resolve(ok({ on: now, how: 'page' }));
+        });
+      });
+    }
+    var el = doc && doc.documentElement;
+    if (!want) {
+      var exit = doc && (doc.exitFullscreen || doc.webkitExitFullscreen);
+      if (exit && nativeFull())
+        return Promise.resolve(exit.call(doc)).then(
+          function () {
+            return ok({ on: false, how: 'browser' });
+          },
+          function () {
+            return ok({ on: nativeFull(), how: 'browser' });
+          },
+        );
+      return Promise.resolve(ok({ on: false, how: 'none' }));
+    }
+    var req = el && (el.requestFullscreen || el.webkitRequestFullscreen);
+    var allowed = doc && doc.fullscreenEnabled !== false && doc.webkitFullscreenEnabled !== false;
+    var tab = function () {
+      // framed by a page that allows no full screen (a post on X): the game's own link, where it can
+      // (noopener: open answers null either way, so 'tab' says it was asked for, not that a popup blocker let it)
+      if (!framed || !globalThis.open) return ok({ on: false, how: 'none' });
+      try {
+        globalThis.open(loc.href, '_blank', 'noopener');
+      } catch {
+        return ok({ on: false, how: 'none' });
+      }
+      return ok({ on: false, how: 'tab' });
+    };
+    if (!req || !allowed) return Promise.resolve(tab());
+    return Promise.resolve()
+      .then(function () {
+        return req.call(el);
+      })
+      .then(
+        function () {
+          setFull(nativeFull());
+          return ok({ on: nativeFull(), how: 'browser' });
+        },
+        function () {
+          return tab();
+        },
+      );
+  };
+
   // ---- saves: this player's own, any JSON value (64 KB each, 16 a player) ----
   function seg(s) {
     return SEG.test(String(s)) ? encodeURIComponent(s) : null;

package/lib/client/godot/gamesfun.gd

@@ -10,6 +10,7 @@
 #   await GamesFun.saves_put("main", {"level": 3}) # this player's saves (JSON, 64 KB each, 16 a player)
 #   var r = await GamesFun.saves_get("main")       # r.data is the value, or null
 #   await GamesFun.scores_submit("best", 1200)     # leaderboards: r.data {improved, best, rank}
+#   await GamesFun.fullscreen()                    # from a button: full screen (again: back)
 #   var top = await GamesFun.scores_top("best")    # top.data: [{rank, player, name, score, at}]
 #   await GamesFun.db_add("levels", {"name": "Moon"})  # the game's own database (xcore add database)
 #   multiplayer.multiplayer_peer = await GamesFun.join_room(code)  # Godot's multiplayer over xgames.fun (xcore add multiplayer)
@@ -122,7 +123,7 @@ func _run(path: String, args: Array):
 	return result
 
 
-## The player's sign-in, from a button press (a window may open). how: "x" or "wallet". -> Dictionary or null
+## The player's sign-in, from a button press (a window may open). how: "x" or "google". -> Dictionary or null
 func sign_in(how := "x"):
 	var p = await _run("signIn", [{"how": how}])
 	_set_player(p)
@@ -134,6 +135,14 @@ func sign_out():
 	_set_player(null)
 
 
+## Full screen, from a button press: on xgames.fun the page around the game goes full screen (or fills the screen in an
+## app's own browser, X's among them); elsewhere the browser's own, or the game's link in a tab of its own (a post on X).
+## on: true, false, or null (the other way). -> {"on": bool, "how": "page" | "browser" | "tab" | "none"}
+func fullscreen(on = null):
+	var r = await _run("fullscreen", [] if on == null else [on])
+	return r.get("data") if r is Dictionary and r.get("data") != null else {"on": false, "how": "none"}
+
+
 func is_signed_in() -> bool:
 	return player != null
 

package/lib/client/server/vouchers.js

@@ -50,9 +50,9 @@ import ECONOMY from '__ECONOMY__';
  * player's daily total there, not in check, so a refusal after check (no proven wallet, a round already used) costs
  * them nothing. Not again for the same round asked twice at once or signed anew near its expiry; if paid throws, the
  * round is not counted and a later ask for it runs paid again.
- * Every wallet is a new player on a chain, and a wallet sign-in costs nothing: cap what a person can take with
- * VOUCHERS.payOnly 'x' (only players signed in with X, counted per X account) for rewards worth farming, and give each
- * grant a perDay total in xsolana.json.
+ * Every wallet is a new player on a chain, and a wallet costs nothing: cap what a person can take with VOUCHERS.payOnly
+ * 'x' (only players signed in with X, counted per X account) or 'account' (X or Google, counted per account; a Google
+ * account is easier to make than an X one) for rewards worth farming, and give each grant a perDay total in xsolana.json.
  */
 export const PAY = {
   async check() {
@@ -60,8 +60,8 @@ export const PAY = {
   },
 };
 
-/** payOnly: 'any' (every signed-in player) | 'x' (only players signed in with X); perMinute: pay and link requests a
- *  player may make a minute; linkSeconds: how long a link text may be signed. */
+/** payOnly: 'any' (every signed-in player) | 'account' (players signed in with X or Google) | 'x' (only players signed
+ *  in with X); perMinute: pay and link requests a player may make a minute; linkSeconds: how long a link text may be signed. */
 export const VOUCHERS = {
   seconds: 7 * 86400,
   renewWithin: 3600,
@@ -106,7 +106,12 @@ async function roundOf(id) {
   return hex(new Uint8Array(await crypto.subtle.digest('SHA-256', te.encode(text))).subarray(0, 16));
 }
 
-/** One person (an X account) as the grant counts them: never the account itself, and a different hash per grant. */
+/**
+ * The person a signed-in player is, for per-person limits: their X account's id, else their Google account's (g:<id>;
+ * an account with both is its X), else null (a wallet's own sign-in from before 2026-11-09).
+ */
+const personOf = player => player?.x?.id ?? (player?.google?.id ? `g:${player.google.id}` : null);
+/** One person (an X account, or a Google account with no X) as the grant counts them: never the account itself, and a different hash per grant. */
 async function personHashOf(signer, grantAddress, person) {
   if (person === null || person === undefined || person === '') return null;
   const own = await hmac(signer.raw, 'xcore voucher person v1');
@@ -313,7 +318,7 @@ async function signRound(env, { grant, wallet, round, amount, person = null }) {
   const r = await roundOf(round);
   if (!r) return refuse(400, 'round', 'A voucher needs the result’s own id (round), used once.');
   if (g.perPerson > 0 && (person === null || person === undefined || person === ''))
-    return refuse(403, 'person', 'This reward counts people: sign in with X to be paid.');
+    return refuse(403, 'person', 'This reward counts people: sign in with X or Google to be paid.');
   let units;
   try {
     // 'grant': the grant's own amount (the voucher names 0); otherwise a whole number of base units above 0
@@ -439,6 +444,8 @@ export async function handleVouchers(request, env) {
   if (method !== 'POST') return reply(refuse(405, 'method', 'POST api/vouchers/pay.'));
   if (VOUCHERS.payOnly === 'x' && !player.x?.id)
     return reply(refuse(403, 'x-only', 'This game pays players signed in with X: sign in with X to be paid.'));
+  if (VOUCHERS.payOnly === 'account' && !personOf(player))
+    return reply(refuse(403, 'account-only', 'This game pays players signed in with X or Google: sign in to be paid.'));
   const b = await bodyOf(request);
   if (!b.ok) return reply(b);
   const body = b.body;
@@ -462,7 +469,7 @@ export async function handleVouchers(request, env) {
     wallet,
     round: pays.round,
     amount: pays.amount,
-    person: player.x?.id ?? null,
+    person: personOf(player),
   });
   // paid once a round: the object flips the round to counted once, so two asks at once can't both run it; one that
   // throws puts it back, so a later ask runs it again (the voucher stays the round's either way)

package/lib/client/unity/GamesFun.cs

@@ -71,7 +71,7 @@ public class GamesFun : MonoBehaviour
 #endif
     }
 
-    /// <summary>The player's sign-in, from a button press (a window may open). how: "x" or "wallet". → the player JSON, or "null".</summary>
+    /// <summary>The player's sign-in, from a button press (a window may open). how: "x" or "google". → the player JSON, or "null".</summary>
     public static Task<string> SignIn(string how = "x") => Call("signIn", "[{\"how\":" + Str(how) + "}]");
     public static Task<string> SignOut() => Call("signOut", "[]");
 

package/lib/dev/index.mjs

@@ -4,6 +4,9 @@
 //   /game/api/*        the game's own server/ under workerd (./server.mjs), WebSockets too, sent on as /api/*; for a
 //                      game with a database and no server/, xcore's stock server, with a local D1 (./d1.mjs)
 //   /platform/v1/*     sign-in, saves and leaderboards (./platform.mjs), the store env.GF reads as well
+//   /platform/v1/live  the game's announcement, config and maintenance, from .gamesfun/live.json (./live.mjs); while
+//                      maintenance is on there, the holding page for its HTML and 503 'maintenance' for its api/
+//                      and platform calls, as xgames.fun's play edge does
 //   <files origin>/*   the game's public project files (env.GF.files, xcore files), on a port of its own: another
 //                      origin to the browser (cross-origin, though same-site: both are 127.0.0.1), as
 //                      <slug>.xgamesusercontent.com is live, where it is another site too (./files.mjs)
@@ -20,6 +23,7 @@ import { ownOrigins } from '../publish/client.mjs';
 import { readServerConfig, API_PREFIX } from '../server/contract.mjs';
 import { PAGE_RPC, rpcWords, solanaRpc } from '../solana-rpc.mjs';
 import { handlePlatform, createPlatformStore } from './platform.mjs';
+import { createLiveRoutes, readLive, LIVE_FILE } from './live.mjs';
 import { createLimitWatch } from './limits.mjs';
 import { serveFiles } from './files.mjs';
 
@@ -217,6 +221,14 @@ export async function startDev(
 
   const limits = createLimitWatch({ log });
   const apiAt = `/game${API_PREFIX}`; // the page's api/ beside it: /game/api/
+  const live = createLiveRoutes({ dir: game, apiAt, say: problems => log(`live: ${problems.join('; ')}`) });
+  const said = await readLive(game);
+  if (said.exists) {
+    const l = said.live;
+    log(
+      `live: ${LIVE_FILE}${l.maintenance ? ' (maintenance on: the game shows its holding page)' : ''}${l.announcement ? ', an announcement' : ''}${l.version ? `, config v${l.version}` : ''}`,
+    );
+  }
   const route = async (req, res, url) => {
     // only this machine's own names: a page on another site that points a name of its own at 127.0.0.1 (DNS rebinding)
     // must not reach the platform, its sign-in tokens or the game's server here
@@ -226,6 +238,7 @@ export async function startDev(
       return true;
     }
     if (url.pathname === PAGE_RPC) return (await forwardRpc(req, res), true);
+    if (await live.handle(req, res, url)) return true;
     if (await handlePlatform(req, res, url, store)) return true;
     if (url.pathname.startsWith(apiAt) || url.pathname === apiAt.slice(0, -1)) {
       const rest = url.pathname.slice('/game'.length) + url.search;
@@ -259,9 +272,12 @@ export async function startDev(
     await files.close();
     throw e;
   }
-  site.server.on('upgrade', (req, socket, head) => {
+  site.server.on('upgrade', async (req, socket, head) => {
     if (!isLocalHost(req.headers.host)) return socket.end('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
     const u = new URL(req.url, 'http://x');
+    // paused (.gamesfun/live.json maintenance): refused, as xgames.fun refuses the game's api/ then
+    if (await live.refuseUpgrade(u.pathname))
+      return socket.end('HTTP/1.1 503 Service Unavailable\r\nRetry-After: 60\r\nConnection: close\r\n\r\n');
     if (server && u.pathname.startsWith(apiAt)) {
       limits.upgrade(u.pathname.slice('/game'.length));
       server.upgrade(req, socket, head, u.pathname.slice('/game'.length) + u.search);